Access Management Flaw in Keycloak Identity Server
CVE-2026-105306

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105306?

A vulnerability exists in the Dynamic Client Registration process of the Keycloak identity and access management server. This flaw allows an attacker with a valid Initial Access Token to register a new client that can circumvent audience checks during token introspection. Consequently, this exploitation can permit unauthorized access to sensitive identity information, roles, and session details from access tokens associated with other applications in the same realm.

References

https://access.redhat.com/security/cve/CVE-2026-105306
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2545802
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Dung Dang Tien for reporting this issue.
.